DPU-based network message processing method and apparatus, device and medium

Abstract

The present disclosure relates to a DPU-based network message processing method and apparatus, a device and a medium. The method provided in the embodiments of the present disclosure uses an association storage table to obtain stream processing information matched with a target communication port, thus avoiding traversing a whole storage table for matching, improving the matching speed and efficiency, and also reducing the storage space for storage tables. On the basis of the obtained stream processing information, a communication address corresponding to a target communication address can be obtained from a communication address table.

Description

A network packet processing method and device based on a DPU, and a device and medium

[0001] Cross-reference to Related Applications

[0002] The present application claims priority to the Chinese patent application No. 202410654877.6, filed on May 24, 2024, and entitled "A network packet processing method and device based on a DPU, and a device and medium". The entire contents of the application are incorporated herein by reference. TECHNICAL FIELD

[0003] The present disclosure relates to the field of network communication, and in particular to a network packet processing method and device based on a DPU, and a device and medium. BACKGROUND

[0004] Cloud networks play a very important role in the development of cloud computing. With the evolution of business, the data processor (DPU) as the foundation of hardware virtualization becomes particularly important. The DPU has a strong demand for networks, and needs to support high-speed data transmission, flexible network configuration and management, and other functions.

[0005] When the DPU processes network packets, classification and filtering of network packets are mainly achieved by matching associated storage tables. The associated storage table is used to store and search for related information to determine the classification of network packets and perform corresponding processing. SUMMARY

[0006] Therefore, the embodiments of the present disclosure provide a network packet processing method and device based on a DPU, and a device and medium.

[0007] In a first aspect, the embodiments of the present disclosure provide a network packet processing method based on a DPU, the method comprising:

[0008] obtaining a network packet to be processed by the DPU currently, wherein the network packet carries a target communication address and a target communication port;

[0009] obtaining flow processing information matched with the communication port based on an associated storage table, and obtaining a corresponding communication address from a communication address table using the flow processing information;

[0010] in the case where the communication address is consistent with the target communication address carried by the network packet, performing a corresponding processing operation on the network packet.

[0011] In a second aspect, the embodiments of the present disclosure provide a network packet processing device based on a DPU, the device comprising:

[0012] An obtaining module is configured to obtain a network packet currently to be processed by a DPU, wherein the network packet carries a target communication address and a target communication port;

[0013] A querying module is configured to obtain flow processing information matched with the communication port based on the association storage table, and obtain a corresponding communication address from the communication address table by using the flow processing information.

[0014] An executing module is configured to perform a corresponding processing operation on the network packet in a case where the communication address is consistent with the target communication address carried by the network packet.

[0015] In a third aspect, a computer device is provided, which comprises a memory and a processor, the memory and the processor are communicatively connected with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method in the first aspect or any of the possible implementation manners thereof.

[0016] In a fourth aspect, a computer readable storage medium is provided, which stores computer instructions, and the computer instructions are used to make a computer perform the method in the first aspect or any of the possible implementation manners thereof. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the prior art, the drawings needed in the specific embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present disclosure, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0018] FIG. 1 is a schematic diagram of a design structure of a CAM table according to some embodiments of the present disclosure;

[0019] FIG. 2 is a schematic diagram of a design structure of a CAM table according to some embodiments of the present disclosure;

[0020] FIG. 3 is a schematic diagram of a flow of a network packet processing method based on a DPU according to some embodiments of the present disclosure;

[0021] FIG. 4 is a schematic diagram of a flow of a network packet processing method based on a DPU according to some embodiments of the present disclosure;

[0022] FIG. 5 is a schematic diagram of a flow of a network packet processing method based on a DPU according to some embodiments of the present disclosure;

[0023] FIG. 6 is a structural block diagram of a network packet processing apparatus based on a DPU according to an embodiment of the present disclosure;

[0024] FIG. 7 is a schematic diagram of a hardware structure of a computer device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] In order to make the objects, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some but not all of the embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present disclosure.

[0026] At present, the associative storage table is usually a content addressable memory (CAM) table. The CAM table is a hardware table structure used for fast lookup and matching of data. The CAM table is usually used in network devices, switches, routers and other high-speed data processing systems to improve the speed and efficiency of data processing. However, the size, matching speed and resource utilization of the current associative storage table are difficult to meet the requirements of DPU network processing.

[0027] Suppose that it is necessary to design a CAM entry to support matching of 512 “dport” and 2 “ip”. As shown in FIG. 1, first, an entry needs to be created for each dport and ip combination. Each entry contains a dport and a corresponding ip value. Therefore, a total of 512 entries need to be created. In order to support 2 different ip values, two sub-entries need to be created for each entry, respectively used to store different ip values. Therefore, each entry needs to contain 2 sub-entries. Each sub-entry contains a dport and an ip value. Each sub-entry needs to occupy a storage space of 2+16 bytes, representing a dport (2 bytes) and an ip (16 bytes), respectively. It can be determined that each entry occupies a storage space of 2×(2+16) bytes.

[0028] The required storage space is calculated according to the following formula: S_old = 1024×(2+16) = 18KByte. In the formula, S_old represents the required storage space, with the unit of byte. 2+16 is the length of the dport and ip values in each sub-entry, with the unit of byte. It is calculated that the required storage space is about 18 kilobytes.

[0029] As can be seen, the existing CAM table consumes a large amount of storage space. By using the communication port domain and the flow processing information to design the associative storage table, the storage space can be effectively saved.

[0030] Specifically, as shown in FIG. 2, a dport field is arranged in each entry, and then a corresponding action field is defined for the dport field of each entry, and the flow processing information is defined through the action field. In this way, each entry only needs to occupy the storage space of the dport field, and does not need to store dport and ip respectively. According to FIG. 1, in the previous scheme, each entry needs to store 2 pointers and 16 bytes of dport and ip information, so 1024 entries are needed to support matching 512 dports and 2 ips, and the total storage space required is $1024x(2+16)=18KByte$. In the scheme of the present application, the formula S_new=512x(2+1)+2x16=2KByte. Among them, 512x(2+1) is the storage space of the CAM table, and the CAM table has a total of 512 entries, each entry has a 2-bit wide matching field (dport) and a 1-bit wide action field (action), so the total storage space is: 512x(2+1), and the 2x16 after the formula is used to store two 16-bit wide indexes pointed to by the action field, that is, the action field pointer, and each index occupies 16 bits, a total of 2 indexes. As can be seen, the total storage space is reduced to 2KByte, which is 9 times less storage resource than the previous scheme.

[0031] According to the embodiments of the present disclosure, a DPU-based network packet processing method, device, equipment and medium are provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0032] In the present embodiment, a DPU-based network packet processing method is provided. FIG. 3 is a flowchart of a DPU-based network packet processing method according to an embodiment of the present disclosure. As shown in FIG. 3, the flow includes the following steps:

[0033] In step S11, a DPU currently to-be-processed network packet is obtained, wherein the network packet carries a target communication address and a target communication port.

[0034] The method provided in the embodiments of the present disclosure is applied to a processor, and the processor referred to in the embodiments of the present disclosure can be a data processor (Data Processing Unit, abbreviated as DPU). Obtaining a DPU currently to-be-processed network packet can mean receiving a network packet (also referred to as a data packet) from a network, and the network packet contains a target communication address and a target communication port. The network packet can be related to various services, especially in terms of network communication and data transmission.

[0035] Specifically, the DPU can be used to forward HTTP requests from clients to servers, which receive the HTTP requests from the client browsers and return corresponding web page contents. In this scenario, the DPU can obtain a network packet to be processed, which carries a target communication address and a target communication port. The DPU uses a new socket to call a recv() method to receive the HTTP request packet sent from the client. Then the HTTP request packet is parsed to obtain the target communication address and the target communication port. According to the target communication address and the target communication port in the request packet, corresponding processing operations are performed.

[0036] In step S12, the flow processing information matched with the communication port is obtained based on the association storage table, and the corresponding communication address is obtained from the communication address table by using the flow processing information.

[0037] In the embodiments of the present disclosure, an association storage table is first created, which stores the mapping relationship between the communication port and the flow processing information. This table can include two fields: the communication port and the flow processing information. The target communication port is obtained from the received network packet. By querying the association storage table, the flow processing information matched with the target communication port is found. Then a communication address table is obtained, which stores the mapping relationship between the flow processing information and the communication address. This table can include two fields: the flow processing information and the communication address. By querying the communication address table, the communication address matched with the flow processing information is found.

[0038] Through the above steps, the flow processing information matched with the communication port can be obtained based on the association storage table, and the corresponding communication address can be obtained from the communication address table by using the flow processing information. The corresponding flow processing information can be found according to the communication port, and the corresponding communication address can be further obtained, so that the processing and forwarding operations of the network packet can be completed.

[0039] In step S13, if the communication address is consistent with the target communication address carried by the network packet, the network packet is executed with corresponding processing operations.

[0040] In the embodiments of the present disclosure, the target communication address is obtained from the received network packet. The obtained target communication address is compared with the queried communication address. If the target communication address is consistent with the communication address, corresponding processing operations are performed according to specific requirements. This includes forwarding the packet to a specific application program for processing or modifying the packet information. The specific processing operations will be different according to the specific application scenarios and requirements. For example, in the scenario of a network server, if the target communication address is consistent with the communication address, the packet can be handed over to the Web server application program for processing, the corresponding response is obtained and sent back to the client.

[0041] The method provided by the embodiments of the present disclosure obtains the flow processing information matched with the target communication port by using the association storage table. The whole storage table can be avoided from being traversed for matching, the speed and efficiency of matching are improved, and the storage space of the storage table is reduced. According to the obtained flow processing information, the communication address corresponding to the target communication address can be obtained from the communication address table. By directly searching the communication address table instead of traversing the whole storage table, the required communication address can be obtained faster. In the case that the communication address is consistent with the target communication address carried by the network packet, the corresponding processing operation is directly performed, and unnecessary processing and resource waste are avoided.

[0042] FIG. 4 is a flowchart of a method for processing a network packet based on a DPU according to an embodiment of the present disclosure. As shown in FIG. 4, the flow includes the following steps:

[0043] In step S21, a network packet currently to be processed by the DPU is obtained, wherein the network packet carries a target communication address and a target communication port. For details, refer to step S11 in the above embodiments, which will not be repeated here.

[0044] In step S22, the flow processing information matched with the communication port is obtained based on the association storage table, and the corresponding communication address is obtained from the communication address table by using the flow processing information.

[0045] In the embodiments of the present disclosure, the flow processing information matched with the target communication port is obtained based on the association storage table, including the following steps A1-A2:

[0046] In step A1, the target communication port is matched with the communication port carried in each entry of the association storage table.

[0047] In the embodiments of the present disclosure, as shown in FIG. 3, the association storage table includes multiple entries and an action domain, one communication port is set in each entry, multiple flow processing information are set in the action domain, and each entry is associated with one flow processing information in the action domain. Therefore, first, each entry in the association storage table is traversed, and the target communication port is compared with the communication port carried in the entry. If the target communication port is successfully matched with the communication port in an entry, it means that the matched entry is found.

[0048] In step A2, in the case that the communication port consistent with the target communication port exists in the association storage table, the flow processing information associated with the target entry where the target communication port is located is obtained.

[0049] In the embodiment of the present disclosure, if there is a communication port consistent with the target communication port in the associated storage table, the flow processing information associated with the entry where the communication port is located is obtained, as shown in FIG. 3, the flow processing information includes action information and an index value pointed by the action information, and the index value points to the communication address table.

[0050] The method provided by the embodiment of the present disclosure can realize flexible action processing by combining the action information with the index value. The action information can define various operations to be performed, such as forwarding, filtering, modification, etc., and the index value can point to the communication address table, providing a dynamic processing capability. In this way, different actions and associated communication addresses can be defined according to specific requirements and scenarios. At the same time, by using the index value to point to the communication address table, a large number of communication addresses can be easily expanded and managed. If it is necessary to add, delete or modify the communication addresses, the corresponding entries in the communication address table need to be updated, without the need to modify the flow processing rules or the action information. In this way, the system can be more flexible and scalable, and the modification and maintenance cost of the flow processing rules can be reduced.

[0051] In the embodiment of the present disclosure, the corresponding communication address is obtained from the communication address table by using the flow processing information, including the following steps B1-B2:

[0052] Step B1, obtaining target action information and target index value associated with the target action information from the flow processing information.

[0053] Step B2, traversing the communication address table according to the target index value to obtain the communication address corresponding to the target index value.

[0054] In the embodiment of the present disclosure, the target index value associated with the target action information is obtained from the flow processing information. Then the communication address table is traversed to find the corresponding communication address according to the target index value. A for loop, a while loop or other loop structure can be used for iteration. In each iteration, the index value of the current element is compared with the target index value to determine whether they are equal. If they are equal, the communication address corresponding to the target index value is found.

[0055] In this way, the communication address corresponding to a specific action is quickly found and obtained in the flow processing information. By associating the action with the index value and mapping in the CAM table and the communication address table, the data flow related to the specific action can be efficiently identified and processed.

[0056] Step S13, in the case that the communication address is consistent with the target communication address carried by the network packet, performing a corresponding processing operation on the network packet.

[0057] In the embodiment of the present disclosure, performing a corresponding processing operation on the network packet includes performing a processing operation indicated by the target action information on the network packet.

[0058] As an example, the following flow processing information is stored in the association storage table of the DPU:

[0059] Flow processing information 1: action information: restart device - index value: ip_index1.

[0060] Flow processing information 2: action information: disconnect - index value: ip_index2.

[0061] Flow processing information 3: action information: modify configuration - index value: ip_index3.

[0062] Suppose the communication address table is as follows: ip_index1: 192.168.1.10. ip_index2: 192.168.1.20. ip_index3: 192.168.1.30. When the DPU receives a network packet, the target communication address in the packet is 192.168.1.20. According to the business requirements, the DPU obtains the target action information and the target index value from the flow processing information, i.e. "disconnect" and 2. Then, according to the target index value 2, the corresponding communication address 192.168.1.20 is found in the communication address table. Finally, the DPU judges whether the target communication address in the packet is consistent with the found communication address. If they are consistent, the DPU performs the "disconnect" operation, i.e. disconnects the connection with the device. It should be noted that the action information can be various device operation instructions, such as restarting the device, disconnecting, modifying the configuration, sending an alarm, etc., which are determined according to the business requirements. When the DPU performs the action, it can send relevant instructions to the device, change the device state, or record relevant logs. The specific action performed is also determined according to the specific business requirements.

[0063] The method provided by the embodiments of the present disclosure can effectively save storage space by using the communication port domain and the flow processing information to design the association storage table. Compared with the prior art, the method provided by the embodiments of the present disclosure saves storage resources, and the size of the storage space is reduced from 18KB to 2KB. This is equivalent to saving 9 times of storage resources, improving the storage efficiency. The hardware cost is reduced, the performance is improved, and the storage resources are used more effectively.

[0064] FIG. 5 is a flowchart of a DPU-based network packet processing method according to an embodiment of the present disclosure. As shown in FIG. 5, the flow includes the following steps:

[0065] Step S31, detecting whether the network environment in which the DPU is located changes.

[0066] In the embodiments of the present disclosure, the DPU periodically sends network probe packets or requests to a certain node in the network through some network interfaces or protocols, such as ARP (Address Resolution Protocol) or ICMP (Internet Control Message Protocol), and receives the response returned by the node. By comparing the previous network environment information and the current received response information, the DPU can determine whether the network environment has changed. For example, the DPU can detect changes in IP addresses, changes in the status of network devices, changes in the availability of network connections, and the like.

[0067] The specific operation process is as follows: the DPU periodically sends network probe packets or requests to a specified node, such as a target IP address. The DPU waits for and receives the response of the node. The previously recorded network environment information is compared with the current received response information. If changes are found, such as different IP addresses, changes in device status, or unavailable connections, the DPU will make appropriate processing according to the business requirements. For example, logs can be recorded, alarms can be sent, network parameters can be reconfigured, and the like. In this way, the DPU can perceive the changes in the network environment in real time and make appropriate processing according to the change situation to ensure the stability and reliability of the network.

[0068] Step S32, in the case where the network environment changes, triggering the update mechanism of the associated storage table.

[0069] In the embodiments of the present disclosure, when the DPU detects that the network environment has changed, such as changes in the IP address, status, or connection of a device, the DPU identifies the type of change. According to the change type, the associated storage table that needs to be updated is determined. When the storage table that needs to be updated is determined, the DPU performs corresponding operations to update the data in the storage table to maintain consistency with the network environment.

[0070] The method provided by the embodiments of the present disclosure can ensure that the data in the storage table is synchronized with the changes in the actual network environment by triggering the update mechanism of the associated storage table. In this way, accurate information can be provided for network management and operation, and the stability and reliability of the network can be ensured.

[0071] Step S33, based on the update mechanism, determining the change type corresponding to the network environment.

[0072] In the embodiments of the present disclosure, the DPU regularly or in real time detects the connectivity of the network link. By sending network probe packets (such as ICMP Echo Request) or using special network monitoring protocols (such as PING, Traceroute), the DPU can determine whether the link is normally connected. If the link fails, the DPU will record the corresponding error information or abnormal state in the monitoring result. The DPU can also determine whether a security event has occurred by monitoring abnormal behavior or specific security events in network communication. This can be achieved through network traffic analysis, intrusion detection systems (IDS), log analysis, etc. Security events can include network attacks (such as DDoS, intrusion attempts), malware propagation, abnormal login activity, etc. The DPU will detect and warn or record the discovered security events according to predefined rules or algorithms.

[0073] According to the monitoring result of the network link connectivity, the DPU can determine whether the link is normal. If the link connection is interrupted or delayed beyond a threshold, it can be determined that the link has failed. According to the monitoring result of the security event, the DPU can determine whether a security event has occurred. If abnormal network activity or indicators related to known security events are detected, it can be determined that a security event has occurred. The DPU will identify the change type of the network link failure and the security event so that subsequent processing and updating operations can be distinguished and corresponding actions can be performed according to different types. Enumerated values, specific markers or agreed methods can be used to identify the change type.

[0074] In addition, the DPU compares the current obtained network information with the previously recorded information. These previously recorded information can be the previous state stored in the database, cache or other data structure. By comparing, changes in the network environment can be found. According to the comparison result, the change type corresponding to the network environment can be determined based on the updating mechanism. These change types can be: IP address change, device state change, connection state change, device addition or removal, etc.

[0075] Step S34, updating the association storage table according to the change type corresponding updating strategy.

[0076] In the embodiments of the present disclosure, updating the association storage table according to the change type corresponding updating strategy includes the following steps C1-C3:

[0077] Step C1, in the case of the change type being a link failure of the network environment, obtaining the failed link in the network environment.

[0078] In the embodiments of the present disclosure, when the DPU detects that a link fails, the failed link is identified. The failed link can be identified by recording the IP address, device identifier or other unique identifier of the failed link. According to the identification of the failed link, the DPU can obtain detailed information of the failed link through network device configuration or other related information sources.

[0079] The specific acquisition method can include querying the status information of the network device: querying the status, interface information, error statistics, etc. of the device through the management interface (such as SNMP) of the network device to obtain the information of the failed link. Through analysis of network traffic and link data, the traffic situation, packet loss rate, delay, etc. of the failed link can be determined, and the failure can be further located. According to the obtained information of the failed link, the DPU can perform diagnosis and positioning to determine the specific cause and location of the failure. This can involve further network device tracking, network topology analysis, hardware troubleshooting, etc. Network administrator tools, network monitoring systems or other network analysis tools can be used to assist in diagnosing and locating the failure.

[0080] Step C2, querying the first communication address corresponding to the failed link and the first index value corresponding to the first communication address.

[0081] In the embodiments of the present disclosure, according to the previously obtained information of the failed link, the communication address of the failed link is obtained. The communication address can be an IP address or other identifier. Through the first communication address, the corresponding first index value is found in the communication address table. The communication address table is an association storage table, which stores the mapping relationship between the communication address and the index value.

[0082] Step C3, updating the first flow processing information corresponding to the first index value in the association storage table to an invalid state.

[0083] In the embodiments of the present disclosure, in the association storage table, the corresponding flow processing information is found according to the first index value. Then the found flow processing information is updated to an invalid state. The update can be modifying the value of the related field or adding a specific mark to the record, indicating that the flow processing information has been invalidated.

[0084] The embodiments of the present disclosure can query the first communication address corresponding to the failed link and the first index value, and update the first flow processing information corresponding to the first index value in the association storage table to an invalid state. In this way, effective management and processing of the failed link can be realized to ensure the reliability and stability of the network.

[0085] In the embodiments of the present disclosure, the association storage table is updated according to the change type corresponding update strategy, including the following steps D1-D3:

[0086] Step D1, in the case of a change type of a network environment security event, obtaining the new link and the second communication address corresponding to the new link.

[0087] In the embodiments of the present disclosure, when the DPU detects a new link, it will be identified. The relevant information of the new link can be recorded, such as device identification, IP address, port, etc. According to the identification of the new link, the detailed information of the new link can be obtained through network device configuration or other related information sources.

[0088] The specific obtaining method can include: querying the state information of the network device: querying the state, interface information, etc. of the device through the management interface (such as SNMP) of the network device to obtain the relevant information of the new link. Analyzing network traffic and link data: through the analysis of network traffic and link data, the communication address, traffic situation, target IP address, etc. of the new link can be determined. According to the obtained new link information, the second communication address is obtained. The communication address can be an IP address or other identifier.

[0089] Step D2, obtaining the second index value corresponding to the second communication address.

[0090] In the embodiments of the present disclosure, according to the second communication address, the corresponding index value is found in the associated index table. The index table stores the mapping relationship between the communication address and the index value. 3. Obtain the second index value: according to the query result, obtain the second index value.

[0091] Step D3, obtaining the second flow processing information based on the second index value and the action information corresponding to the new link, and updating the second flow processing information to the associated storage table.

[0092] In the embodiments of the present disclosure, first, the relevant information of the new link is determined, such as source address, target address, protocol type, etc. Then, according to these information combined with the existing flow processing strategy, the second flow processing information is obtained. Finally, the second flow processing information is updated to the associated storage table. The update operation can be completed by insertion, update or replacement, etc.

[0093] In this embodiment, a DPU-based network message processing device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and contemplated.

[0094] The present embodiment provides a DPU-based network message processing device, as shown in FIG. 6, which includes:

[0095] The obtaining module 51 is configured to obtain a network packet currently to be processed by the DPU, wherein the network packet carries a target communication address and a target communication port;

[0096] The querying module 52 is configured to obtain flow processing information matched with the communication port based on the association storage table, and obtain a corresponding communication address from the communication address table by using the flow processing information.

[0097] The executing module 53 is configured to perform a corresponding processing operation on the network packet in a case where the communication address is consistent with the target communication address carried by the network packet.

[0098] In the embodiment of the present disclosure, the querying module 52 is configured to match the target communication port with the communication port carried by each entry in the association storage table, and obtain the flow processing information associated with the target entry where the target communication port is located in a case where the association storage table contains the communication port consistent with the target communication port.

[0099] In the embodiment of the present disclosure, the querying module 52 is configured to obtain target action information and a target index value associated with the target action information from the flow processing information, and traverse the communication address table according to the target index value to obtain the communication address corresponding to the target index value.

[0100] In the embodiment of the present disclosure, the executing module 53 is configured to perform a processing operation indicated by the target action information on the network packet.

[0101] In the embodiment of the present disclosure, the apparatus further comprises an updating module, and the updating module comprises:

[0102] The detecting unit is configured to detect whether a network environment in which the DPU is located changes.

[0103] The control unit is configured to trigger an updating mechanism of the association storage table in a case where the network environment changes.

[0104] The analyzing unit is configured to determine a change type corresponding to the network environment based on the updating mechanism.

[0105] The processing unit is configured to update the association storage table according to an updating strategy corresponding to the change type.

[0106] In the embodiment of the present disclosure, the processing unit is configured to obtain a fault link in the network environment in a case where the change type is a link fault of the network environment, query a first communication address corresponding to the fault link and a first index value corresponding to the first communication address, and update first flow processing information corresponding to the first index value to an invalid state in the association storage table.

[0107] In the embodiments of the present disclosure, the processing unit is configured to, in the case that the change type is a network environment security event, acquire a new link and a second communication address corresponding to the new link; acquire a second index value corresponding to the second communication address; acquire second flow processing information based on the second index value and action information corresponding to the new link, and update the second flow processing information to the association storage table.

[0108] Referring to FIG. 7, FIG. 7 is a structural schematic diagram of a computer device according to an optional embodiment of the present disclosure. As shown in FIG. 7, the computer device includes one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are communicatively connected by using different buses, and can be installed on a common mainboard or in other manners as needed. The processor can process instructions executed in the computer device, including instructions stored in the memory or graphics information of the memory to display a GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple storage devices, if necessary. Similarly, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0109] The processor 10 can be a central processor, a network processor, or a combination thereof. The processor 10 can further include a hardware chip. The hardware chip can be an application specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic gate array, a generic array logic, or any combination thereof.

[0110] The memory 20 stores instructions executable by the at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiments.

[0111] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created by the use of the computer device according to the display of the landing page of the applet, and the like. In addition, the memory 20 can include a high-speed random access memory, and can further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some optional embodiments, the memory 20 can optionally include a memory remotely arranged with respect to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0112] The memory 20 can include a volatile memory, such as a random access memory, and / or can include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive. The memory 20 can also include a combination of the above-mentioned types of memories.

[0113] The computer device also includes a communication interface 30 for the computer device to communicate with other devices or communication networks.

[0114] The embodiments of the present disclosure further provide a computer readable storage medium, and the method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or recorded in a storage medium, or be implemented through computer code originally stored in a remote storage medium or non-transitory machine readable storage medium and downloaded to a local storage medium, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special purpose hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned types of memories. It can be understood that the computer, processor, microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, processor or hardware, the method shown in the above embodiments is implemented.

[0115] Although the embodiments of the present disclosure are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present disclosure, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method for processing network packets based on a DPU, the method comprising: obtaining a network packet currently to be processed by the DPU, wherein the network packet carries a target communication address and a target communication port; obtaining, based on an association storage table, flow processing information matched with the communication port, and obtaining, based on the flow processing information, a corresponding communication address from a communication address table; in a case where the communication address is consistent with the target communication address carried by the network packet, performing a corresponding processing operation on the network packet.

2. The method of claim 1, wherein the obtaining, based on the association storage table, the flow processing information matched with the target communication port comprises: matching the target communication port with a communication port carried by each entry in the association storage table; in a case where the association storage table contains a communication port consistent with the target communication port, obtaining flow processing information associated with a target entry in which the target communication port is located.

3. The method of claim 1, wherein the obtaining, based on the flow processing information, the corresponding communication address from the communication address table comprises: obtaining, from the flow processing information, target action information and a target index value associated with the target action information; and traversing the communication address table according to the target index value to obtain a communication address corresponding to the target index value.

4. The method of claim 3, wherein the performing, on the network packet, the corresponding processing operation comprises: performing, on the network packet, a processing operation indicated by the target action information.

5. The method of claim 1, further comprising: detecting whether a network environment in which the DPU is located changes; in a case where the network environment changes, triggering an update mechanism of the association storage table; based on the update mechanism, determining a change type corresponding to the network environment; and updating the association storage table according to an update strategy corresponding to the change type.

6. The method of claim 5, wherein the updating the association storage table according to the update strategy corresponding to the change type comprises: in a case where the change type is a link failure of the network environment, obtaining a failure link in the network environment; querying a first communication address corresponding to the failure link and a first index value corresponding to the first communication address; and updating, in the association storage table, first flow processing information corresponding to the first index value to an invalid state.

7. The method of claim 5, wherein the updating the association storage table according to the update strategy corresponding to the change type comprises: in a case where the change type is a security event of the network environment, obtaining a new link and a second communication address corresponding to the new link; obtaining a second index value corresponding to the second communication address; and obtaining second flow processing information based on the second index value and action information corresponding to the new link, and updating the second flow processing information to the association storage table.

8. An apparatus for processing network packets based on a DPU, the apparatus comprising: An obtaining module is configured to obtain a network packet currently to be processed by a DPU, wherein the network packet carries a target communication address and a target communication port; An inquiring module is configured to obtain flow processing information matched with the communication port based on an association storage table, and obtain a corresponding communication address from a communication address table by using the flow processing information; An executing module is configured to execute a corresponding processing operation on the network packet in a case where the communication address is consistent with the target communication address carried by the network packet.

9. A computer device, comprising: A memory and a processor, which are in communication connection with each other, and the memory stores computer instructions, and the processor executes the computer instructions to perform the method in any one of claims 1 to 7.

10. A computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the method in any one of claims 1 to 7.

Images